Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add JinLee794/agent-framework-skills --skill skill-pack-auditgit clone --depth 1 https://github.com/JinLee794/agent-framework-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jinlee794/agent-framework-skills/skill-pack-audit)<a href="https://agentmods.dev/skills/jinlee794/agent-framework-skills/skill-pack-audit"><img src="https://agentmods.dev/badge/skills/jinlee794/agent-framework-skills/skill-pack-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jinlee794/agent-framework-skills/skill-pack-audit"><img src="https://agentmods.dev/badge/skills/jinlee794/agent-framework-skills/skill-pack-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.01725 |
| Opus 5 | $0.00045 | $0.00863 |
| Sonnet 5 | $0.00018 | $0.00345 |
| Haiku 4.5 | $0.00009 | $0.00172 |
Grade A, and why
skill-pack-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 159 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Pack Audit
A skill pack degrades in predictable ways: routing tables get copied, the same version fact gets restated, two descriptions start competing for the same task, and the always-on tier quietly grows. This is the review that finds those.
Adjacent, different job: maf-dev-loop/references/skill-sync.md checks whether a claim is
still true. This checks whether it is in the right place, exactly once.
Invariants
Every finding below is a violation of one of these. State which one when reporting.
- One routing table. It lives in
rules/repository.mdc.md. A skill may link to a sibling for a specific reason; it may not list them all. - One owner per falsifiable fact. A version number, symbol name, enum spelling, or removed API belongs to the skill that owns that SDK surface. Everywhere else, cite the owner. Exactly one second copy is allowed: a row in a conformance grep table, because there the string is the search pattern.
- Descriptions partition the task space. Two skills must not plausibly answer the same
request. Where boundaries are close, say so with an explicit
NOT for … — load X instead. - Universal rules live in the always-on tier. A rule that applies to all work must not sit inside a task-scoped skill, or it is only conditionally reachable.
- The loaded tier stays small.
SKILL.mdshould be roughly a third of its skill's total; the rest belongs inreferences/. - Every reference resolves.
Procedure
Run all six. Each is cheap and each catches a different class.
1. Inventory and size distribution
Get-ChildItem .cursor\skills -Recurse -Filter *.md |
Sort-Object FullName |
ForEach-Object { [pscustomobject]@{
Path = $_.FullName.Replace("$PWD\", '')
Lines = (Get-Content $_.FullName).Count } } |
Format-Table -AutoSize
For each skill compute SKILL.md ÷ (SKILL.md + references). Report the ratios together — the
outlier is the finding, not any absolute threshold. A skill much above its peers has reference
material sitting in the always-loaded tier (invariant 5).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 159 lines · 90 tokens per session scan A 05eec3c170f2
skill-pack-audit is a skill published in the GitHub repository JinLee794/agent-framework-skills (2 stars, last pushed 1mo ago), licensed MIT. It adds 90 tokens to every session and 1,725 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
claude-on-foundry
End-to-end assistant skill for the Claude on Foundry Starter Kit (Azure-Samples/claude). Walks customers through deploying, verifying, modifying, debugging, and tearing down a Claude model deployment on Microsoft Foundry using either the Bicep or Terraform IaC variant in this repo, with one-command guidance via azd…
aspire-deployment
WORKFLOW SKILL — Deploy Aspire apps from AppHost models to Docker Compose, Kubernetes, Azure, or AWS. WHEN: "deploy Aspire app", "publish Aspire artifacts", "deploy to Azure Container Apps", "generate Kubernetes artifacts", "tear down Aspire deployment". INVOKES: aspire CLI, Aspire docs, target cloud/container CLIs.…
entra-a2a-mcp-obo
Best practices, tips, and gotchas for Entra ID, Entra Agent ID, A2A protocol, MCP protocol, and agentgateway-based OBO token exchange — distilled from loop-runtime's entraagentid.md docs. Use when setting up, wiring, or debugging Entra app registrations, Entra Agent ID blueprints, OBO chains, A2A/MCP auth, app-code…
aspire-monitoring
ANALYSIS SKILL - Observe Aspire apps: logs, traces, metrics, resource state, telemetry export, browser telemetry, and the standalone dashboard. Routes between local Aspire CLI, AKS workload diagnostics, and deployed Azure resource health. USE FOR: aspire logs, aspire otel logs, aspire otel traces, aspire otel spans…
harness-engineering
Adopt repository-level harness engineering for coding agents. Use when a user wants to prevent repeated AI coding-agent mistakes by turning failures into durable instructions, drift checks, regression tests, failure memory, and adoption reports tailored to the target repository.
get-api-docs
Use this skill when you need documentation for a third-party library, SDK, or API before writing code that uses it — for example, "use the OpenAI API", "call the Stripe API", "use the Anthropic SDK", "query Pinecone", or any time the user asks you to write code against an external service and you need current API…